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SBU information is currently shared according to an ungoverned body of policies and 

practices that confuse both its producers and users. 



Inconsistency in SBU policies 
greatly increases the likelihood 
of erroneous handling and 
sharing of information. 



Across the Federal government 
there are at least 107 unique 
markings and over 130 different 
labeling or handling processes 
and procedures for SBU 
information. 



Current SBU sharing practices not 
only impede the timeliness, 
accuracy, and ready flow of 
information that should be shared, 
but often fail to protect 
information in a consistent and 
transparent manner. 



ConltaoWa'S®"®"'''® 

^ \nformat»on 









practices 
■sers. 

^oede^tAe 

- terror'sm 

fa'\\ 



tou 



Ou, 






o 






A\\JO 



■g c 

II'. 



nation 'S 






Sensitive But Unclassified 



Sensitive but unclassified (SBU) information is shared 
today according to an ungoverned and diverse body of 
policies and practices that confuse both its producers 
and users. 

Current sharing practices not only impede the 
timeliness, accuracy, and ready flow of terrorism 
information that should be shared, but often fail to 
control the flow of information that should not be 
shared. Sensitive but unclassified (SBU) information 
is shared today according to an ungoverned and 
diverse body of policies and practices that confuse 
both its producers and users. 
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The Presidential Memorandum on the Designation and Sharing of Controiied 
Unciassified information was released on May 9, 2008. 



This Memorandum: 




• Adopts, defines, and institutes “Controlled Unclassified Information” 
(CUI) as the single categorical designation for all information 




referred to as “Sensitive But Unclassified” (SBU) in the Information 
Sharing Environment (ISE); and 




• Establishes a corresponding new CUI Framework for designating, 
marking, safeguarding, and disseminating information designated as 
CUI; and 
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• Designates the National Archives and Records Administration 
(NARA) as the Executive Agent, to oversee and implement the 
new CUI Framework. 
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The Duroose of the CUI Framework is to standardize practices 
and therebv improve the sharinq of information. 
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The Memorandum articulates what CAN and CANNOT be designated as controlled 

unclassified information. 



Information shall be desiqnated as CUI... 


Information shall not be desiqnated as 
CUI... 


• If a statute so requires or authorizes; or 

• The head of the originating department or agency, 
through regulations, directives, or other specific 
guidance to the agency, determines that the 
information is CUI. Such determination should be 
based on mission requirements, business prudence, 
legal privilege, the protection of personal or 
commercial rights, or safety or security. Such 
department or agency directives, regulations, or 
guidance shall be provided to the Executive Agent for 
his review. 


• To conceal violations of law, inefficiency, or 
administrative error; 

• To prevent embarrassment to the U.S. Government, 
any U.S. official, organization, or agency; 

• To improperly or unlawfully interfere with competition; 

• To prevent or delay the release of information that 
does not require such protection; 

• If it is required by statute or Executive Order to be 
made available to the public; or 

• If it has been released to the public under proper 
authority. 
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The CUI Council is assigned the following functions as directed in 
the May 9, 2008 Presidential Memorandum. 



Roles and Responsibilities: 

• Advises the Executive Agent in 
developing procedures, guideiines, and 
standards necessary to estabiish, 
implement, and maintain the CUI 
Framework; 

• Serves as the primary advisor to the 
Executive Agent as unique issues arise 
pertaining to the CUI Framework; 

• Ensures coordination among the depts. 
and agencies participating in the CUI 
Framework; and 

• Advises Executive Agent in resolving 
complaints and disputes among 
departments and agencies about proper 
designation or marking of CUI. 



Council Membership 



National Archives and Records 
Administration (E.A. & Chair) 


Federal Bureau of Investigation 


Department of Justice 


Department of Commerce 


Department of Homeland Security 


Office of Management and Budget 


Office of the Director of National 
Intelligence 


Department of Interior 


Department of Energy 


Department of State 


Department of Defense 


Joint Chiefs of Staff 


Department of Health and Human 
Services 


Department of Transportation 


National Counter Intelligence Center 


Department of T reasury 


Central Intelligence Agency 


Program Manager for the Information 
Sharing Environment 


Environmental Protection Agency 


Nuclear Regulatory Commission 


Two State, Local, Tribal 
Representatives 


Two Private Sector Representatives 
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Status by CUI Policy Category 



Policy Category 


Category Definition 


Activity to Date 


Safeguarding 


How information is stored and protected. 


Introduced to CUI Council: 09118108 
Working Group Meetings: 3 
Iterations of Policy: 3 


Dissemination 


How information is passed between CUI users. 


Introduced to CUI Council: 10 / 16/08 
Working Group Meetings: 2 

Specified Dissemination Instruction Development meetings: 3 
Iterations of Policy: 3 


Dispute 

Resolution 


Reconciles differences in CUI designation 
between stakeholders. 


Introduced to CUI Council: 12 / 04/08 
Iterations of Policy: 1 


Marking 


How information is labeled so that users are 
aware that they are handling CUI. 


Introduced to CUI Council: 01 / 15/09 
Working Group Meetings: 2 
Iterations of Policy: 2 


Designation 


Types of information that will fall under the CUI 
Framework. 


Introduced to CUI Council : 02 / 19/09 
Working Group Meetings: 2 
Iterations of Policy: 2 


Life Cycle 


Limits on how long information is eligible to be 
part of the CUI Framework 


Scheduled Introduction to CUI Council: 05 / 21/09 
Scheduled Working Group Meetings: 2 


Regulatory 

Change 


Identifies regulatory change necessary to 
implement the CUI Framework 


Scheduled Introduction to CUI Council: 05 / 21/09 
Scheduled Working Group Meetings: 2 
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Freedom of Information Act & CUI 



The May 9, 2008 Presidential Memorandum states that: 

“CUI markings may inform but do not control the decision of 
whether to disclose or release the information to the public, 
such as in response to a request made pursuant to the 
Freedom of Information Act (FOIA).” 
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Next Steps 



General Implementation 

- Develop and populate publicly accessible web-based CUI Registry 

- Develop centralized CUI Training 

- Oversight function served by the CUI Executive Agent 

- Increased coordination with non-Federal stakeholders 

Policy 

- Develop detailed guidance on CUI Life Cycle 

- Address Regulatory Change necessary for standardization throughout departments and agencies 

- Further refinement of policies to include public comment 
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Guiding Principles for CUI Innplementation 



Protection 

CUI will be 

appropriately 

protected. 



Sharing 


Rationalization 


Flexibility 


Inclusiveness 


Standardization 


CUI will be 


CUI policy will be 


CUI policy 


CUI policy will 


CUI policy will be 


shared as 


developed with 


development 


address the 


standardized so 


broadly as 


deliberate 


will respond to 


needs of all ISE 


all participants are 


possible. 


consideration to 


changes 


partners, both 


governed by 




managing risk 


through 


users and 


uniform definitions 




and information 


centralized 


producers of 


and practices. 




sharing. 


management 

and 

distributed 

execution. 


information, 
taking into 
account all 
media types. 





Transparency 

CUI policy will 
be developed 
with input by 
State, local, 
tribal, and 
private sector 
entities and 
comment by 
the public. 
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Challenges 



Scope 

Designation/Identification of CUI 
Life Cycle / “Decontrol” 
Safeguarding Measures 
Regulatory Change 
Accountability & Oversight 
Funding for CUI Implennentation 
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Contact Information 



Controlled Unclassified Information Office 
National Archives and Records Administration 
700 Pennsylvania Avenue, N.W., Room 100 
Washington, DC 20408-0001 

(202) 357-6870 (voice) 

(202) 357-6871/72 (fax) 
cui@nara.gov 
www.archives.gov/CUI 




